Missing Authorization in OpenEMR - #VU158865
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to take over patient portal accounts and access sensitive patient information.
The vulnerability exists due to missing authorization checks in OpenEMR's create_portallogin.php endpoint and PatientAccessOnsiteService::saveCredentials() method when processing patient portal credential changes. A remote user can select another patient as the current session patient and submit replacement portal credentials directly to the endpoint to overwrite that patient's credentials, sign in as the patient, and access portal-visible health information without patient-demographics or portal-management permission.
Exploitation requires the patient portal to be enabled and the target patient to have an existing portal account. Deployments enforcing portal email verification also require knowledge of the target patient's email address.